Draw AI authoring lines across a payments codebase

Your team owns a payments service in Go. It has 5 areas: the HTTP API layer, a double-entry ledger, a fraud-scoring service, glue code such as CSV importers and admin tools, and the test suite. Leadership wants a one-page policy that puts each area in one of 3 groups:

• agents write freely, with normal review
• a person writes, and AI only assists
• no agent-generated code at all

Where does each area go, and how do you defend the line you expect to be criticized most?